"File is encrypted, but no key was provided." trying to upgrade Win10 1511 to 1607 via CM CB 1606

[hybrid]

We are experiencing an issue trying to install the 1607 Feature Update using a Windows 10 Servicing Plan in ConfigMgr CB (5.0.8412.1000). We have a simple single server SCCM infrastructure.

 

The required KB3159706 has been installed on the server, and the additional steps in "More information" at the bottom of that KB article have also been carried out. We've cleared the download of the Feature Update and downloaded it again after verifying the steps. Both the WSUS site and the Configuration Manager site in IIS have the .esd mimetype set to application/vnd.ms-cab-compressed.

 

The deployment appears on clients (5.00.8412.1007 CCM client), and downloads the 2 GB or so judging by the time taken, but fails to apply. We never get to reboot into the WinPE(?) stage to perform the upgrade.

 

The reported error code is 0xC180011

 

This is from $Windows.~BT\Sources\Panther\setupact.log:

2016-08-22 22:08:11, Info                  MOUPG  RecoverCrypto: Entering Execute Method
2016-08-22 22:08:11, Info                  MOUPG  DlpTask: Resetting action [0] progress start time.
2016-08-22 22:08:11, Error                 MOUPG  RecoverCrypto: File is encrypted, but no key was provided.
2016-08-22 22:08:11, Error                 MOUPG  CDlpActionRecoverCrypto::DoCrypto(1713): Result = 0xC1800118
2016-08-22 22:08:11, Error                 MOUPG  CDlpActionRecoverCrypto::ExecuteRoutine(2465): Result = 0xC1800118
2016-08-22 22:08:11, Warning               MOUPG  CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x2101]
2016-08-22 22:08:11, Warning               MOUPG  CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x2100]
2016-08-22 22:08:11, Error                 MOUPG  CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::Execute(441): Result = 0xC1800118
2016-08-22 22:08:12, Info                  MOUPG  RecoverCrypto: Leaving Execute Method
2016-08-22 22:08:12, Error                 MOUPG  CDlpTask::ExecuteAction(3243): Result = 0xC1800118
2016-08-22 22:08:12, Warning               MOUPG  CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x2004]
2016-08-22 22:08:12, Warning               MOUPG  CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x2003]
2016-08-22 22:08:12, Error                 MOUPG  CDlpTask::ExecuteActions(3397): Result = 0xC1800118
2016-08-22 22:08:12, Info                  MOUPG  Waiting for actions thread to exit.
2016-08-22 22:08:12, Info                  MOUPG  Actions thread has exited.
2016-08-22 22:08:12, Warning               MOUPG  CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x2004]
2016-08-22 22:08:12, Warning               MOUPG  CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x2000]
2016-08-22 22:08:12, Error                 MOUPG  CDlpTask::Execute(1631): Result = 0xC1800118
2016-08-22 22:08:12, Warning               MOUPG  CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x3000]
2016-08-22 22:08:12, Info                  MOUPG  DlpTask: Leaving Execute Method
2016-08-22 22:08:12, Error                 MOUPG  CSetupManager::ExecuteTask(2067): Result = 0xC1800118
2016-08-22 22:08:12, Error                 MOUPG  CSetupManager::ExecuteTask(2030): Result = 0xC1800118
2016-08-22 22:08:12, Error                 MOUPG  CSetupManager::ExecuteInstallMode(690): Result = 0xC1800118
2016-08-22 22:08:12, Error                 MOUPG  CSetupManager::ExecuteDownlevelMode(391): Result = 0xC1800118
2016-08-22 22:08:12, Info                  MOUPG  Setup phase change: [SetupPhaseUnpack] -> [SetupPhaseError]
2016-08-22 22:08:12, Info                  MOUPG  SetupManager::OpenOrCreateTask: Found task [Exit] in state [0x6] - Action [0xFFFFFFFF].
2016-08-22 22:08:12, Info                  MOUPG  SetupManager::OpenOrCreateTask: Deleting...
2016-08-22 22:08:13, Info                  MOUPG  SetupManager::OpenOrCreateTask: Deleted task [Exit]
2016-08-22 22:08:13, Info                  MOUPG  SetupManager::OpenOrCreateTask: Creating new task [Exit].
2016-08-22 22:08:13, Info                  MOUPG  CreateTask: Name = [Exit], WorkingPath = [C:\$WINDOWS.~BT\Sources], TransportId = [00000000-0000-0000-0000-000000000000], Flags = [0x0]
2016-08-22 22:08:13, Info                  MOUPG  Finalize: Entering Prepare Method
2016-08-22 22:08:13, Info                  MOUPG  Finalize: Leaving Prepare Method
2016-08-22 22:08:13, Info                  MOUPG  DlpTask: Entering Execute Method
2016-08-22 22:08:13, Info                  MOUPG  DlpTask: Transport not set. Skipping download phase.
2016-08-22 22:08:13, Info                  MOUPG  DlpTask: Executing Actions...
2016-08-22 22:08:13, Info                  MOUPG  Action execution thread timeout period: [1000 ms]
2016-08-22 22:08:13, Info                  MOUPG  ImageExit: Initializing SetupResult: [0xc1800118]
2016-08-22 22:08:13, Info                  MOUPG  ImageExit: Initializing Extended:    [0x30002]
2016-08-22 22:08:13, Info                  MOUPG  ImageExit: Initializing Scenario:    [5]
2016-08-22 22:08:13, Info                  MOUPG  ImageExit: Initializing Mode:        [2]
2016-08-22 22:08:13, Info                  MOUPG  ImageExit: Initializing Target:      [C]
2016-08-22 22:08:13, Info                  MOUPG  ImageExit: Initializing SQM:         [TRUE]
2016-08-22 22:08:13, Info                  MOUPG  ImageExit: Initializing PostReboot:  [FALSE]

Even after clearing the CCM client cache, SoftwareDistribution folder, deleting the software update package from the CCM server and downloading and deploying it again, we see this issue across each of the several systems we have tried.

 

Any further insights would be greatly appreciated! Is there anywhere else we should be looking on the server to do with decrypting the .esd?

[anyweb]

hi Peter, can you zip up all the logs (*.xml files, *.log) in that folder and send them to me to look at please ?

[anyweb]

from the logs, I can see that this is Windows 10 Education, did you service it with the corresponding update ? (edu>edu)

[hybrid]

Indeed: our deployment is for the Feature Update to Windows 10 Education 1607. The en-us and en-gb versions of that SKU are the only upgrades downloaded. Our machines believe they are on en-us language pack(?) (although we have UK regional settings).

 

Our Servicing Plan rule:

 

 

The results of previewing this:

 

 

Our deployments to two collections:

 

[anyweb]

ok try deleting the 1607 updates (all of them) in WSUS (the wsus console), then resync the sup in ConfigMgr, and try again.

[rayddi]

Hi Hybrid,

to fix the issue, you need to re-install the SUP.

More info here;

https://venusingireddy.blogspot.com.au/2016/08/recovercrypto-file-is-encrypted-but-no.html?showComment=1472377988261#c7202095427114772578

thanks

[anyweb]

not according to Microsoft you don't, where did you get the idea that you need to reinstall the SUP ?

[hybrid]

Here's what we've done:

 

• Removed the test deployments of the Feature Update
• Removed the Servicing Plan associated with those deployments (so there are no Servicing Plans)
• Removed the Deployment Package that Servicing Plan was attached to
• Deleted the folder associated with that Deployment Package from the disk
• Rebooted the SCCM & WSUS server
• Altered the SUP configuration to remove the "Upgrades" classification (Administration > Sites > (Primary site) > Configure Site Components > Software Update Point > Classifications)
• Altered the WSUS configuration to also not include the "Upgrades" classification: Get-WsusClassification | Where-Object -FilterScript {$_.Classification.Title -Eq "Upgrades"} | Set-WsusClassification -Disable [reference]
• Ran a Synchronize Software Updates from Software Library > All Software Updates in the SCCM console.
• Verified that the Upgrades category is off in both SCCM console and WSUS.
• Removed updates with PowerShell:
  • $s = Get-WsusServer
  • $s.SearchUpdates("version 1607") | Foreach { Write-Host $_.Id.UpdateId; $s.DeleteUpdate($_.Id.UpdateId) }
  • $s.SearchUpdates("version 1511, version 10586") | Foreach { Write-Host $_.Id.UpdateId; $s.DeleteUpdate($_.Id.UpdateId) }
• Ran the WSUS Server Cleanup Wizard with only "unneeded update files" checked.
• Ran a Synchronize Software Updates from Software Library > All Software Updates in the SCCM console.
• Rebooted the SCCM/WSUS server.
• Altered the SUP configuration to add the "Upgrades" classification (Administration > Sites > (Primary site) > Configure Site Components > Software Update Point > Classifications)
• Ran a Synchronize Software Updates from Software Library > All Software Updates in the SCCM console.

 

I've run out of time to continue with this today, so I will update this post when we try to deploy again...

[hybrid]

I've now also:

 

• Created a new servicing plan "Windows 10 Education 1607 Servicing Plan". It uses a new deployment package.
  • 
• Clicked Run now on this new Servicing Plan.
• Verified that the content download is in progress:
  • 
• Verified that the two expected upgrades (en-us and en-gb that matched our rule when previewed) are "Downloaded". (Not "Deployed" yet)
• Got impatient and ran a Software Update point synchronisation to try and get the deployment to appear.
• Verified that the two expected upgrades are now "Downloaded" and "Deployed":
  • 
• Went to a client that is in the deployed collection and cleared the CCM cache from the Control Panel UI
• Deleted C:\~WINDOWS.BT from the client (from its previous upgrade attempt)
• Ran all the Action cycles in the Control Panel UI for the ConfigMgr client
• Went to Software Center > Updates > Windows 10 Feature Update... and ran the upgrade.

 

We still see the same error on the client after the download and install attempt.

 

 

Really trying to avoid a SUP reinstall if possible!

[RLC-Andrew]

I had some other issues...recorded in a different post. Having said that, I have finally reached this error message and this point in my troubleshooting.

 

From a Social.TechNet discussion, I have also come to the conclusion that I need to reinstall the SUP. I really don't want to have to do it...but there is compelling reason to believe it will work (knowing that I have tried all the other options).

 

Back when my SCCM environment was smaller and unused for production, I remember having to do the remove and add the sup role and it fixed the problem that day.

 

I'm not sure what gotchas and/or side-effects are involved now. I know you basically remove the roll. Watch the sup log till its done. Reboot?. Then Add the role back in and configure it as you had it configured before. What I don't know is...what else needs done (or re-done). How will doing this effect the existing software updates, groups, packages etc.

[jr19]

I've now also:

 

• Created a new servicing plan "Windows 10 Education 1607 Servicing Plan". It uses a new deployment package.
  • 1607-serv-plan.png
• Clicked Run now on this new Servicing Plan.
• Verified that the content download is in progress:
  • downloading-content.png
• Verified that the two expected upgrades (en-us and en-gb that matched our rule when previewed) are "Downloaded". (Not "Deployed" yet)
• Got impatient and ran a Software Update point synchronisation to try and get the deployment to appear.
• Verified that the two expected upgrades are now "Downloaded" and "Deployed":
  • downloaded-and-deployed.png
• Went to a client that is in the deployed collection and cleared the CCM cache from the Control Panel UI
• Deleted C:\~WINDOWS.BT from the client (from its previous upgrade attempt)
• Ran all the Action cycles in the Control Panel UI for the ConfigMgr client
• Went to Software Center > Updates > Windows 10 Feature Update... and ran the upgrade.

 

We still see the same error on the client after the download and install attempt.

 

failed-again.png

 

Really trying to avoid a SUP reinstall if possible!

Have you made any progress on this? I've seen various Technet threads discussing this problem, but no one seems to have a good answer. I'm running into the same issue myself and was hoping to have a working solution in place by Monday.

[anyweb]

i've asked Microsoft PG for comment on a fix, they are aware of the problem and are working on the solution

[keety]

Cool! Getting the same thing here as well... I'm guessing they didn't give you a rough estimate as to when it would be fixed though

 

 

I hope we won't have to go through this every single time there's a point release... WaaS seems a bit more fiddly than I was expecting!

[anyweb]

no timeframe yet but rest assured they are working on it...

[keety]

Cool! We just upgraded at the weekend and I was looking forward to trying this out!

[RLC-Andrew]

Going through this today. It at least has a new step not previously published. Fingers crossed.

 

https://support.microsoft.com/en-us/kb/3194588

[RLC-Andrew]

Yes, this support article worked. I had previously done all of the steps mentioned in the article, except for this one listed below.

 

// delete files from tbFile table

declare @NotNeededFiles table (FileDigest binary(20) UNIQUE);
insert into @NotNeededFiles(FileDigest) (select FileDigest from tbFile where FileName like '%14393%.esd' except select FileDigest from tbFileForRevision);
deletefrom tbFileOnServer where FileDigest in (select FileDigest from @NotNeededFiles)
delete from tbFile where FileDigest in (select FileDigest from @NotNeededFiles)

[hybrid]

We have followed the new steps in KB3194588 and, in particular, the new database steps as @RLC-Andrew points out:

declare @NotNeededFiles table (FileDigest binary(20) UNIQUE);

insert into @NotNeededFiles(FileDigest) (select FileDigest from tbFile where FileName like '%14393%.esd'  except select FileDigest from tbFileForRevision);

delete from tbFileOnServer where FileDigest in (select FileDigest from @NotNeededFiles)

delete from tbFile where FileDigest in (select FileDigest from @NotNeededFiles)

It works now!

 

I repeat myself from above, but for clarity here is what we did, in full:

 

• Removed the test deployments of the Feature Update
• Removed the Servicing Plan associated with those deployments (so there are no Servicing Plans)
• Removed the Deployment Package that Servicing Plan was attached to
• Deleted the folder associated with that Deployment Package from the disk
• Rebooted the SCCM & WSUS server
• Altered the SUP configuration to remove the "Upgrades" classification (Administration > Sites > (Primary site) > Configure Site Components > Software Update Point > Classifications)
• Altered the WSUS configuration to also not include the "Upgrades" classification: Get-WsusClassification | Where-Object -FilterScript {$_.Classification.Title -Eq "Upgrades"} | Set-WsusClassification -Disable [reference]
• Ran a Synchronize Software Updates from Software Library > All Software Updates in the SCCM console.
• Verified that the Upgrades category is off in both SCCM console and WSUS.
• Removed updates with PowerShell:
  • $s = Get-WsusServer
  • $s.SearchUpdates("version 1607") | Foreach { Write-Host $_.Id.UpdateId; $s.DeleteUpdate($_.Id.UpdateId) }
  • $s.SearchUpdates("version 1511, version 10586") | Foreach { Write-Host $_.Id.UpdateId; $s.DeleteUpdate($_.Id.UpdateId) }
• Ran the WSUS Server Cleanup Wizard with only "unneeded update files" checked.
• Ran a Synchronize Software Updates from Software Library > All Software Updates in the SCCM console.
• Rebooted the SCCM/WSUS server.
• Altered the SUP configuration to add the "Upgrades" classification (Administration > Sites > (Primary site) > Configure Site Components > Software Update Point > Classifications)
• Ran the following SQL on the SUSDB:
  • declare @NotNeededFiles table (FileDigest binary(20) UNIQUE);
    
    insert into @NotNeededFiles(FileDigest) (select FileDigest from tbFile where FileName like '%14393%.esd' except select FileDigest from tbFileForRevision);
    
    delete from tbFileOnServer where FileDigest in (select FileDigest from @NotNeededFiles)
    
    delete from tbFile where FileDigest in (select FileDigest from @NotNeededFiles)
• Ran a Synchronize Software Updates from Software Library > All Software Updates in the SCCM console.
• Created a new servicing plan "Windows 10 Education 1607 Servicing Plan". It uses a new deployment package.
  • 
• Clicked Run now on this new Servicing Plan.
• Verified that the content download is in progress:
  • 
• Verified that the two expected upgrades (en-us and en-gb that matched our rule when previewed) are "Downloaded". (Not "Deployed" yet)
• Got impatient and ran a Software Update point synchronisation to try and get the deployment to appear.
• Verified that the two expected upgrades are now "Downloaded" and "Deployed":
  • 
• Went to a client that is in the deployed collection and cleared the CCM cache from the Control Panel UI
• Deleted C:\~WINDOWS.BT from the client (from its previous upgrade attempt)
• Ran all the Action cycles in the Control Panel UI for the ConfigMgr client
• Went to Software Center > Updates > Windows 10 Feature Update... and ran the upgrade.

The install process then proceeded, with Software Center then requesting a restart. The test client system then restarted into the WinPE part of the upgrade process (what formerly was the "Donut of Destiny" screen).

 

The upgrade completely successfully!

[superhl]

Trying to resolve this issue on a 2012 r2 server with a built in sql database. Do I complete the same steps?

Ran the following SQL on the SUSDB:

• declare @NotNeededFiles table (FileDigest binary(20) UNIQUE);
  
  insert into @NotNeededFiles(FileDigest) (select FileDigest from tbFile where FileName like '%14393%.esd' exceptselect FileDigest from tbFileForRevision);
  
  delete from tbFileOnServer where FileDigest in (select FileDigest from @NotNeededFiles)
  
  delete from tbFile where FileDigest in (select FileDigest from @NotNeededFiles)

[beany1]

@hybrid

 

You sir are a legend! Just signed up to say thank you for saving me! Was about to uninstall everything as other websites suggest!

 

@superhl - I use the built in database, yep you do those same steps on the database!

[suspect0]

I've now also:

 

• Created a new servicing plan "Windows 10 Education 1607 Servicing Plan". It uses a new deployment package.
  • 1607-serv-plan.png
• Clicked Run now on this new Servicing Plan.
• Verified that the content download is in progress:
  • downloading-content.png
• Verified that the two expected upgrades (en-us and en-gb that matched our rule when previewed) are "Downloaded". (Not "Deployed" yet)
• Got impatient and ran a Software Update point synchronisation to try and get the deployment to appear.
• Verified that the two expected upgrades are now "Downloaded" and "Deployed":
  • downloaded-and-deployed.png
• Went to a client that is in the deployed collection and cleared the CCM cache from the Control Panel UI
• Deleted C:\~WINDOWS.BT from the client (from its previous upgrade attempt)
• Ran all the Action cycles in the Control Panel UI for the ConfigMgr client
• Went to Software Center > Updates > Windows 10 Feature Update... and ran the upgrade.

 

We still see the same error on the client after the download and install attempt.

 

failed-again.png

 

Really trying to avoid a SUP reinstall if possible!

 

Just tried this in my environment. Got 1607 working on at least 1 laptop so far, going to try mine at somepoint. Thank you for the excellent documentation!

[ecr80]

Excellent, followed hybrid's steps, all is working.

[lupoz91]

Hi,

I've followed the steps @hybrid suggested, but my goal is to update from Windows 10 1607 to 1703. The update is still failing with the same error 0xC1800118.

But when I try the SQL query 

select TotalResults = Count(*)
from tbFile
where (IsEncrypted = 1 and DecryptionKey is NULL) or (FileName like '%15063%.esd' and IsEncrypted = 0) 

this is what I got:

Msg 207, Level 16, State 1, Line 3
Invalid column name 'IsEncrypted'.
Msg 207, Level 16, State 1, Line 3
Invalid column name 'DecryptionKey'.
Msg 207, Level 16, State 1, Line 3
Invalid column name 'IsEncrypted'.

What does it mean? It seems that something is missing on the SUSDB, also after installing the KB3159706...

 

Please help me